标签：#microsoft365

By Suvankar Chakraborty | Principal Engineer — IAM, Modern Workplace Management & IT Operations The Collaboration Platform That Became a Governance Nightmare Microsoft Teams was deployed at extraordinary speed across the enterprise world. In most organisations I know, the deployment timeline went something like this: March 2020, global pandemic, remote work mandate, Teams switched on, everyone told to use it, governance deferred because there was no time. Five years later, the governance that was deferred in 2020 has still not been implemented in most of those environments. The result is predictable and consistent across industries: Teams sprawl at industrial scale. Hundreds of Teams that nobody owns. Channels for projects that ended three years ago. Guest users from partnerships that dissolved. Sensitive conversations in channels that include contractors who should not have visibility. Files shared in Teams chat — bypassing SharePoint governance entirely — on devices with no management policy. Meeting recordings stored in OneDrive folders that anyone with a link can access. Bot integrations that have permissions to read your Teams messages and access your calendar, approved by a user who clicked through an OAuth consent screen without reading it. In 13+ years of enterprise IAM and IT operations work, Teams governance has become one of the most consistently mismanaged areas of Microsoft 365. Not because it is technically difficult — the controls Microsoft provides are comprehensive. But because Teams sits at the intersection of IT, security, compliance, and the organisational culture of collaboration, and that intersection is where governance programmes go to die. This article is about why enterprises get Teams governance wrong, and what getting it right actually looks like — in specific, actionable, implementable terms. Why Teams Is a Governance Problem Unlike Any Other M365 Workload To understand the governance challenge, you need to understand what Microsoft Team

What Happened On July 20, 2026, cybersecurity firm Group-IB disclosed a new espionage implant dubbed HollowGraph that hijacks compromised Microsoft 365 mailboxes to run a command-and-control (C2) channel hidden inside calendar events. The malware attaches encrypted files to calendar entries dated May 13, 2050 — far enough in the future that a mailbox owner would never scroll to them — and retrieves operator instructions from the same dead drop. All traffic moves through the Microsoft Graph API, making the activity indistinguishable from legitimate M365 usage. At least 12 systems have been infected, with three actively communicating with the threat actor between June 3 and July 9, 2026. The indicators point to a targeted espionage campaign focused on Israeli organizations . Technical Analysis HollowGraph is a lightweight .NET DLL that supports only two commands: GET and SEND . To receive tasking, it queries the compromised mailbox's calendar for an event titled in the format "Event ID: <7-char-taskID>", downloads the attached file, and decrypts it using RSA and AES-256-GCM. To exfiltrate data, the implant creates a new calendar entry titled "Boss{..}ID{..}" and uploads stolen files encrypted with the attacker's public RSA key. The Group-IB research team described the mailbox calendar as a "covert dead-drop," with HollowGraph retrieving commands from events scheduled within a fixed one-hour window between 22:00 and 23:00 UTC on the far-future date. The hybrid encryption scheme uses separate RSA key pairs for inbound and outbound channels, keeping them cryptographically isolated. A second, unencrypted channel runs over DNS tunneling . HollowGraph refreshes its Microsoft Entra ID (Azure AD) credentials by querying IPv6 AAAA records from the attacker-controlled domain cloudlanecdn[.]com . Each returned IPv6 address yields 14 usable payload bytes, which the malware assembles and decodes as UTF-8 text to update its logAzure.txt configuration file — a file masquerading as a